Secure cookies

What it checks

Whether each cookie the home page sets has Secure.

Why it matters

A cookie without Secure can be sent over plain http://, where it can be read in transit.

How to fix it

1. Add the Secure attribute to every cookie.
2. Name cookies with the __Host- prefix where you can: browsers then insist on Secure and on the site's own host.

Set-Cookie: __Host-session=…; Path=/; Secure; HttpOnly; SameSite=Lax